Data carriers in the form of smart cards are used in an increasing variety of application areas. Especially widespread cards are ones according to the standard ISO 7810 which consist of a plastic carrier incorporating an integrated semiconductor circuit and contact means for making electric connections with a corresponding reader. It has also been proposed to make the card carrier smaller or omit it completely and instead install for example a single-chip microcontroller in watches, jewelry, garments or other articles of daily use. The term “smart card” is therefore intended to include all current and future transportable (small) objects in which a microcontroller is embedded to enable its owner or holder to perform smart card-typical interactions with corresponding, specially provided interaction stations. Typical smart card applications are the credit card, money card, health insurance card or telephone card. The term “application” refers here to the totality of all data, commands, operations, states, mechanisms and algorithms within a smart card which are necessary for operating a smart card within a system, for example a credit card payment system.
Each application usually has its own corresponding smart card, and each new application and update of an existing application likewise yield a new smart card. It is therefore fundamentally desirable to have a smart card which can be used for a plurality of applications of different service providers and operators of card systems, such as credit card organizations, banks, insurances, telephone companies, etc.
A file organization for such a smart card suitable for several applications is shown in Rankl/Effing, “Handbuch der Chipkarten,” Carl Hauser Verlag, 1996, chapter 5.6. The organization structure described therein is based on ISO/IEC standard 7816-4. At the top of the file structure is a master file containing the directories of all other files present on the smart card. Subordinate to the master file are one or more dedicated files containing the file names of files combined in groups, in particular belonging to one application. Subordinate to each dedicated file are finally one or more elementary files containing the useful data of an application. This print in addition describes the reloading of program code as technically possible but inexpedient for reasons of security. As the most promising measure for overcoming the security problems it refers to setting up a memory management unit which monitors program code to be executed as to whether it keeps to the allocated limits.
The print WO-A1-98/09257 discloses a system and method for loading applications onto a smart card which make it possible to put program and application data of further applications into a smart card in addition to the data of already loaded applications. Precautions are taken on the basis of suitable cryptographic technologies to allow verification of the authorization of the agency performing the data reloading. After the data of an additional application have entered the memory of the smart card, the authenticity of the corresponding program data is checked. Then the program data are checked with respect to their syntax and valid type limitations. If an incongruity is ascertained in one of these check steps, the additionally loaded data are discarded and deleted in the memory. The known system allows controlled reloading of applications after the card has been issued to the final user. However, it means that a card issuer issuing a smart card with available, free memory space to a service provider, for example, must already know the identity of all agencies of the service provider which are later to be entitled to offer applications to an end-user for reloading. This can be done by the card issuer certificating certain public signature keys of service providers in order to be able to do a check of the authenticity of reloaded data by depositing its own public signature key, e.g. in the ROM mask of the smart card. However, in the known system a card issuer has no possibility of checking the memory volume occupied by the service providers on a single smart card, beyond authenticity and correct syntax.
DE 197 18 115 A1 further discloses a smart card and method for loading data onto a smart card which make it possible to put card applications on a smart card after the end of the card production process. Provided on the smart card is a container storage space into which service providers can load applications of their own. In the container storage space the basic program structure of reloadable applications is predefined; what is reloaded is only dedicated data and keys. Predefinition of the structures of loadable applications achieves a reliable separation of data of different service providers on a card. This print does not provide for the reloading of applications with unknown data structure. It does not in general describe alternatives of predefining application structures for managing the container storage space. The concept of predefining application structures cannot be used if program code of indefinite scope is to be loaded onto a card later. The solution found in DE 197 18 115 A1 is therefore unsuitable for applying complete program codes of applications later.